JWT Decoder — Decode JSON Web Tokens Online
Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Decode-only: the signature is NOT verified — a decoded token can still be forged.
- Timestamps (exp, iat, nbf) are interpreted as Unix seconds per RFC 7519.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
What a JWT actually is
A JSON Web Token is three base64url-encoded segments joined by dots: header, payload and signature. The header states the algorithm (alg) and type. The payload carries claims — registered ones like iss (issuer), sub (subject), aud (audience), exp (expiry) and iat (issued-at), plus any custom claims the issuer adds.
Decoding reads the first two segments. It proves nothing about authenticity — anyone can craft a token with arbitrary claims. Always verify the signature and the issuer's keys server-side before trusting any claim.
Common red flags to look for
An alg of "none" or a weak symmetric algorithm like HS256 where a public algorithm was expected, a missing exp claim (the token never expires), an iat far in the past combined with no rotation policy, and sensitive data in claims — payloads are only base64, never encrypted, so anything placed in them is readable by anyone who holds the token.
If you found this token in a log file, a commit or a paste, treat it as compromised and ask the issuer to revoke or rotate it.
Frequently asked questions
- Is it safe to paste a JWT here?
- Yes — decoding happens entirely in your browser with JavaScript. The token is never sent over the network, which you can verify in DevTools → Network. That said, treat every decoded token as sensitive and never paste production tokens into tools that do upload.
- Why does it say 'signature not verified'?
- Verification requires the issuer's secret or public key and an active validation of claims. This tool only decodes — it's for inspection and debugging, not authentication.
- The token has three parts but won't decode — why?
- Segments must be base64url-encoded JSON. Tokens that are encrypted (JWE, five segments), opaque reference tokens, or truncated copies will fail to decode.
- What does 'expired' mean for a token?
- The exp claim is in the past. Well-behaved APIs reject expired tokens — if yours still accepts them, that's a bug worth reporting.
Related calculators
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.
Paste your API's CORS response headers and detect dangerous setups: wildcard origins with credentials, null-origin acceptance, reflected origins and missing Vary: Origin.